This document explains the security decisions made when this repository was made public, and why certain files are gitignored.

Last Updated: February 2026 (v2.6.0)

Before making this repository public, a comprehensive security audit was performed. This document explains what was done and why, to prevent future maintainers from accidentally reverting these protections.

Problem: Contained 139 files including:

• Personal project CLAUDE.md files with client names
• Email addresses (e.g., client emails in project docs)
• Project-specific configurations with identifying information

Solution:

• Added to .gitignore
• Removed from Git tracking
• Rewrote Git history to purge all traces

Impact: Users who fork this repo won't inherit personal project data.

Problem: Two folders with similar names but different purposes:

• .vscode/ (with dot) - Standard VSCode workspace folder, auto-created
• vscode/ (without dot) - Our custom setup scripts folder

The .vscode/ folder contained settings.json with:

• Hardcoded user paths (C:\Users\tjn\.claude)
• Local network IPs (192.168.1.40)
• Remote SSH host configurations

Solution:

• Entire .vscode/ folder gitignored
• Our vscode/ folder tracked (but settings.json within it gitignored)
• Clear documentation distinguishing the two

Impact: Machine-specific VSCode configurations don't leak to public repo.

Problem: VSCode settings file contained:

"git.scanRepositories": ["C:\\Users\\tjn\\.claude", "."],
"security.allowedUNCHosts": ["192.168.1.40"],
"remote.SSH.remotePlatform": {
    "192.168.1.10": "windows",
    "192.168.1.40": "linux"
}

Solution:

• Gitignored the file
• Users create their own after cloning
• Setup script helps configure it

Impact: Local network topology not exposed.

Important: This file IS tracked and SHOULD remain tracked.

Why it's different: Unlike vscode/settings.json, the root settings.json contains Claude Code toolkit configuration:

• Permission allow/deny lists
• Enabled plugins
• Hook configurations
• MCP server defaults

These are not personal data - they're the toolkit's functionality configuration that users want when cloning this repo.

Used git-filter-repo to completely remove sensitive files from Git history:

# Remove .archive/ from all history
python -m git_filter_repo --invert-paths --path .archive/ --force

# Remove settings files from all history
python -m git_filter_repo --invert-paths --path settings.json --path vscode/settings.json --force

Even if files are deleted in the latest commit, they remain in Git history. Anyone can:

1. Clone the repo
2. Run git log --all --oneline -- .archive/
3. Checkout historical commits
4. Access the "deleted" files

History rewriting ensures complete removal.

git-filter-repo removes the origin remote for safety. After running it:

git remote add origin https://github.com/travisjneuman/.claude.git
git push --force origin master

Ask yourself:

1. Does this file contain hardcoded paths?
2. Does this file contain IP addresses?
3. Does this file contain email addresses or client names?
4. Is this file auto-generated by an IDE?
5. Would another user's version of this file conflict?

If ANY answer is yes, the file should probably stay gitignored.

1. Review this document first
2. Check the file for personal/machine-specific data
3. Consider whether tracking benefits outweigh privacy risks
4. Document your decision if you make changes

Watch for these patterns that indicate a file should NOT be tracked:

• C:\Users\<username>\ - Windows user paths
• /Users/<username>/ - macOS user paths
• /home/<username>/ - Linux user paths
• 192.168.x.x - Local network IPs
• 10.x.x.x - Private network IPs
• Email addresses
• API keys or tokens
• Client/project names

# Verify specific files are ignored
git check-ignore -v .vscode/settings.json vscode/settings.json

# List all ignored files
git status --ignored

# Should return empty if properly cleaned
git log --all --oneline -- .archive/
git log --all --oneline -- vscode/settings.json

# Search for IP addresses
grep -r "192\.168\." --include="*.json" --include="*.md"

# Search for user paths (adjust username)
grep -r "C:\\\\Users\\\\tjn" --include="*.json" --include="*.md"

• FOLDER-STRUCTURE.md - Complete folder map
• CONFIGURATION.md - Settings file details
• ../vscode/README.md - VSCode setup instructions